Clive_A wrote

Hi  @Cold_in_Canada 

Are you able to ping the IP address of the router after you connect to the VPN router?

Based on your description, you only have one ACL, that's correct? Try without any ACL.

Try a different DNS as well if you cannot access any website.

 
Thanks for your reply @Clive_A.  I do have other ACLs but I have effectively disabled all "Block" policy rules to test this.  (In lieu of a proper disable, I mimic disabling by changing the service type to "FTP").

Even with all Block ACLs changed to "ftp", after I connect using OpenVPN and I do a LAN scan, all I can see is myself.  I can't even see my gateway.

So this is a bit perplexing.... The VPN IP Pool I'm using is a secondary VLAN but with all block ACLs effectively disabled, I don't think that should matter.  And I did test it initially using my main VLAN as the VPN IP Pool.

Any other ideas on where to look?  The system log shows me virtually nothing (mostly just DHCP assignments).  I don't think I need to un-check anything under "Packet Anomaly Defense" for OpenVPN?

Also @Clive_A , I don't know (because of the "TP-LINK" tag in your handle) if you have influence over the configuration guides, but if you do, this one is reasonably good "How to Configure TP-Link Omada Gateway as OpenVPN Server on Standalone Mode".  But it doesn't mention that you also need to add the UDP/1194 service type and a WAN->Me ACL.  Both of which I believe is required, and must be added manually when operating in standalone mode.  Adding those two additional steps would benefit others in the future.

Thanks.

Ah ok, thank you @Clive_A for this feedback.  You're really helping me understand things.

I guess I was thinking that without any Firewall ACLs at all, the router would be, by default, blocking ALL ports from the outside.  Now based on your feedback, I'm thinking that I subsequent ACL I have is likely blocking the outside.

I have various VLANs and I only want my "MainNetwork" to be able to manage the ER605.  So I have a "block" ACL where the source is "!MainNetwork" and the destination is "Me" (for all service types).  And perhaps that's blocking the outside as well (I admit, I never thought of !MainNetwork as including the WAN until now) - the extra and higher priority "allow" ACL for OpenVPN (UDP/1194 only) that I mentioned in my previous post is perhaps overriding that.

  @Cold_in_Canada I encountered exactly the same problem and solved by modify config setting from "comp-lzo no" to "comp-lzo adaptive"

I think tp link should set "comp-lzo adaptive" as default